CVE-2026-4952 Stored Cross-Site Scripting in OrderAdministration Portal (AuftragsManager) via Business Reference in VertiGIS WebOrderSystem

The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference. JavaScript code can be inserted into this field. On its own this only affects the user who entered it self-XSS. However, the business reference is...

CVE-2026-4952 Stored Cross-Site Scripting in OrderAdministration Portal (AuftragsManager) via Business Reference in VertiGIS WebOrderSystem

The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference. JavaScript code can be inserted into this field. On its own this only affects the user who entered it self-XSS. However, the business reference is...

CVE-2026-4952

The VertiGIS WebOrderSystem (specifically version 7.0.8.6 and potentially others) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the "ASMobile" web interface of the "GIS Portal" package, where authenticated users can input JavaScript into a business reference field. While...

VertiGIS WebOrderSystem cross-site scripting vulnerability

VertiGIS WebOrderSystem versions 7.0.8.6 and earlier contain a cross-site scripting vulnerability. This vulnerability arises because business reference fields in the ASMobile web interface allow authenticated users to insert JavaScript code. Such code is stored alongside order details and execute...

PT-2026-121786

The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference. JavaScript code can be inserted into this field. On its own this only affects the user who entered it self-XSS. However, the business reference is...